Jump to content

Recommended Posts

Posted

There's a race condition error in engine.dll:

 

engine.dll:00CE80AA lea     eax, [eax+edx*4]
engine.dll:00CE80AD cmp     dword ptr [eax+10h], 0  <----- now it's not 0, so it won't jump on the next line
engine.dll:00CE80B1 jz      0CE80C8h     -- meanwhile some other thread sets dword ptr [eax+10h] to 0 --
engine.dll:00CE80B3 mov     ecx, [eax+10h]    <----- so now we have ecx == 0
engine.dll:00CE80B6 mov     ecx, [ecx+1Ch]    <----- read dword ptr [0+1ch] -> CRASH
engine.dll:00CE80B9 test    ecx, 0x4000000
engine.dll:00CE80BF jnz     short loc_CE80C8
engine.dll:00CE80C1 mov     dword ptr [eax+10h], 0
 
It can be fixed this way:
 
engine.dll:00CE80AA lea     eax, [eax+edx*4]
engine.dll:00CE80AD mov     ecx, [eax+10h]   <----- we copy that value from memory
engine.dll:00CE80B0 jecxz   0CE80C8h          <----- and compare it this way - jecxz is a nice instruction :)
engine.dll:00CE80B2 mov     ecx, [ecx+1ch]    <----- even if some other thread resets dword ptr [eax+10h], we have still copy in ecx
engine.dll:00CE80B5 test    ecx, 0x4000000
engine.dll:00CE80BB jne     0CE80C8h
engine.dll:00CE80BD nop
engine.dll:00CE80BE nop           <----- we saved 4 bytes :)
engine.dll:00CE80BF nop
engine.dll:00CE80C0 nop
engine.dll:00CE80C1 mov     dword ptr [eax+10h], 0
 
There are two occurrences of this bug in engine.dll, to fix them both replace following (in unpacked engine.dll ofc)
 
old: 83 78 10 00 74 15 8B 48 10 8B 49 1C F7 C1 00 00 00 04 75 07
new: 8B 48 10 E3 16 8B 49 1C F7 C1 00 00 00 04 75 0B 90 90 90 90
 
old: 83 78 10 00 74 13 8B 48 10 F7 41 1C 00 00 00 04 75 07
new: 8B 48 10 E3 14 F7 41 1C 00 00 00 04 75 0b 90 90 90 90
 
Enjoy ;)
Posted

 

There's a race condition error in engine.dll:

 

engine.dll:00CE80AA lea     eax, [eax+edx*4]
engine.dll:00CE80AD cmp     dword ptr [eax+10h], 0  <----- now it's not 0, so it won't jump on the next line
engine.dll:00CE80B1 jz      0CE80C8h     -- meanwhile some other thread sets dword ptr [eax+10h] to 0 --
engine.dll:00CE80B3 mov     ecx, [eax+10h]    <----- so now we have ecx == 0
engine.dll:00CE80B6 mov     ecx, [ecx+1Ch]    <----- read dword ptr [0+1ch] -> CRASH
engine.dll:00CE80B9 test    ecx, 0x4000000
engine.dll:00CE80BF jnz     short loc_CE80C8
engine.dll:00CE80C1 mov     dword ptr [eax+10h], 0
 
It can be fixed this way:
 
engine.dll:00CE80AA lea     eax, [eax+edx*4]
engine.dll:00CE80AD mov     ecx, [eax+10h]   <----- we copy that value from memory
engine.dll:00CE80B0 jecxz   0CE80C8h          <----- and compare it this way - jecxz is a nice instruction :)
engine.dll:00CE80B2 mov     ecx, [ecx+1ch]    <----- even if some other thread resets dword ptr [eax+10h], we have still copy in ecx
engine.dll:00CE80B5 test    ecx, 0x4000000
engine.dll:00CE80BB jne     0CE80C8h
engine.dll:00CE80BD nop
engine.dll:00CE80BE nop           <----- we saved 4 bytes :)
engine.dll:00CE80BF nop
engine.dll:00CE80C0 nop
engine.dll:00CE80C1 mov     dword ptr [eax+10h], 0
 
There are two occurrences of this bug in engine.dll, to fix them both replace following (in unpacked engine.dll ofc)
 
old: 83 78 10 00 74 15 8B 48 10 8B 49 1C F7 C1 00 00 00 04 75 07
new: 8B 48 10 E3 16 8B 49 1C F7 C1 00 00 00 04 75 0B 90 90 90 90
 
old: 83 78 10 00 74 13 8B 48 10 F7 41 1C 00 00 00 04 75 07
new: 8B 48 10 E3 14 F7 41 1C 00 00 00 04 75 0b 90 90 90 90
 
Enjoy ;)

 

do you even know what that code is doing ? originaly , just setting to zero wouldnt explain the crash.

Posted

do you even know what that code is doing ? originaly , just setting to zero wouldnt explain the crash.

 

Not in the global scope, but for example the first one is in UGameEngine::LoadMapThread.

They call something like

 

UObjectLoader *res = UObject::GetLoader(something);

if (res->var84h[something2]->var10h) {

    here they access res->var84h[something2]->var10h->var1c

    which is totally wrong if you don't have mutex here

}

 

so my fix does simply this:

 

void *someptr = res->var84h[something2]->var10h;

if (*someptr) {

    now i work with someptr which is copy

}

 

the best solution would be to add mutexes, but I don't have the source code :))

Posted

Not in the global scope, but for example the first one is in UGameEngine::LoadMapThread.

They call something like

 

UObjectLoader *res = UObject::GetLoader(something);

if (res->var84h[something2]->var10h) {

    here they access res->var84h[something2]->var10h->var1c

    which is totally wrong if you don't have mutex here

}

 

so my fix does simply this:

 

void *someptr = res->var84h[something2]->var10h;

if (*someptr) {

    now i work with someptr which is copy

}

 

the best solution would be to add mutexes, but I don't have the source code :))

well thats acctualy explains better, a check if exist pattern 

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



  • Posts

    • You always find a way to lower the bar. Consistency matters. I admire your dedication to being completely unaware of how little you matter.     at least you are not entirely useless you can always serve as a bad example
    • hahahahahahahahahahahaha this says more about MaxCheaters than about me xD
    • I already finished my panel for change name and gender, anyway need restart, im used schema  $stmt = $conn->prepare("EXEC lin_ChangeCharacterName2 ?, ?, ?"); for change name... also for change gender i used if ($race == 5) // Kamael race ID; modify this value as per your database { $error = "Gender change is not allowed for Kamael race characters."; } else { $stmt = $conn->prepare(" UPDATE user_data SET gender = ?, face_index = 0, hair_shape_index = 0, hair_color_index = 0 WHERE char_id = ? AND account_name = ? "); Sorry no idea how to add cached update in myext64 about, not have any  solution for this yet compatible to myext64 code. This is my panel make in php http://177.73.143.43:8080/account/ Cool panel for me, without experience in any code. Without help from any people here 🙄
    • Базы данных от прямых источников!                                  Холодка                 Реги                 Депы                 Богатые физики                                  Много актуальных гео!                 Замена брака!                 Гарант+                                  Контакты                 ТГ - @yashkatsigun    
    • Don't listen to that idiot @Nightw0lf — he doesn't know or understand anything... he just talks nonsense. Here's the solution, just to prove that they're the useless ones giving you meaningless and useless answers.   function disableCharacter($charId){ $buf = pack("cVV", 0x14, $charId, 1); return $this->Send($buf); } function enableCharacter($charId, $accountId){ $buf = pack("cVV", 0x15, $charId, $accountId); return $this->Send($buf); } function kickCharacter($charId) { $buf = pack("cV", 0x05, $charId); $tmp = $this->Send($buf); sleep(2); return $tmp; } //-------------------------------------------------------------------------------- if ($func==7)//DESHABILITAR PERSONAJE { $char_id = $var1; $CACHED->kickCharacter($char_id); $respuesta = $CACHED->disableCharacter($char_id); RegistrarActividad("disableCharacter",$respuesta,GetCharNameByCharId($char_id)."(".$char_id.")",0,0,0,0); } else if ($func==8)//HABILITAR PERSONAJE { $char_id = $var1; $account_id = $var2; $CACHED->kickCharacter($char_id); $respuesta = $CACHED->enableCharacter($char_id,$account_id); RegistrarActividad("enableCharacter",$respuesta,GetCharNameByCharId($char_id)."(".$char_id.")",$account_id,0,0,0); } //-------------------------------------------------------------------------------- $CACHED->disableCharacter($char_id); $tabla = sqlsrv_query($conexion_lin2world, "UPDATE user_data SET xxxxxxxxxxxx WHERE char_id=".$char_id.""); $CACHED->enableCharacter($char_id,$account_id); Now just compare the stupidity said by that imbecile @Nightw0lf with the answer I gave you... Thanks to people like this, MaxCheaters is in the state it's in... They keep following useless people who are good for nothing 😉  
  • Topics

×
×
  • Create New...

AdBlock Extension Detected!

Our website is made possible by displaying online advertisements to our members.

Please disable AdBlock browser extension first, to be able to use our community.

I've Disabled AdBlock